Install ModSecurity on Apache for Ubuntu: A Comprehensive Guide

How to install ModSec with Apache on Ubuntu Linux

A ModSecurity Apache Ubuntu setup means installing 💿 the firewall module directly onto your web server to block common online attacks. ModSecurity filters incoming web traffic to protect your server, and it runs inside Apache, so it adds a layer of security without a separate proxy or appliance.

The setup has three parts. First you install Apache and the ModSecurity module. Then you switch the engine from logging only to blocking. Finally you add the OWASP Core Rule Set, which supplies the actual detection rules. Here is how to install it 💿 with the Apache HTTP server.

Install ModSecurity and Apache

Install ModSecurity and Apache with Ubuntu’s built-in package manager. This is the quickest way to add web traffic filtering, and it keeps the module updatable with the rest of your system packages.

1. Open a terminal on your Ubuntu server.
2. Run the commands in the block below. They download the ⬇️ Apache web server and the ModSecurity module. Apache may already be present on your server, and in that case the package manager simply skips it.

sudo apt update
sudo apt install apache2 libapache2-mod-security2

When the install finishes, Apache starts on its own. You can then confirm the module is loaded with the Apache control tool. Checking that ModSec is installed involves running the commands below.

apachectl -M | grep security

The command above should list the loaded modules, and the ModSecurity module should be among them. The output should look similar to this:

Turning on the ModSecurity module requires running the commands presented below. Enabling this module is crucial for activating ModSecurity's web application firewall features, which protect the website.

If the module does not appear in the list, the install did not complete, or Apache has not been restarted since you installed it. Go back, re-run the install commands and read any error messages.

ModSecurity configuration on the Apache server in Ubuntu actively blocks threats by adjusting main settings. Begin by copying the recommended configuration file, modsecurity.conf-recommended, and then edit this file to best protect the server.

By default, ModSecurity ships with a recommended configuration that only detects problems and does not block them. You need your own copy of that file so you can edit it.

1. Find the default configuration file at /etc/modsecurity/modsecurity.conf-recommended.
2. Copy this file and rename it to modsecurity.conf, using the command in the block below. Leave the original file untouched so you have a clean reference if you need to start over.

sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

Next, open the newly created config file in a text editor.

3. Run the commands in the block below to open the file. Use a terminal editor and sudo, as the file belongs to root.

sudo nano /etc/modsecurity/modsecurity.conf

4. Find the highlighted lines in the file shown below.
5. Change the value from DetectionOnly to On. This switches ModSecurity from logging only to actively blocking requests that match a rule.

# -- Rule engine initialization ----------------------------------------------
# Enable ModSecurity, attaching it to every transaction. Use detection
# only to start with, because that minimises the chances of post-installation
# disruption.
#
SecRuleEngine On

# -- Request body handling ---------------------------------------------------
# Allow ModSecurity to access request bodies. If you don't, ModSecurity
# won't be able to see any POST parameters, which opens a large security
# hole for attackers to exploit.

SecRequestBodyAccess On

# Enable XML request body parser.
# Initiate XML Processor in case of xml content-type

6. Save the file and exit the editor.
7. Restart Apache so it reads the new setting. The command is in the block below.

Apache only reads its configuration at startup, so the change does nothing until you restart it. To undo the change later, set the value back to DetectionOnly and restart Apache again. That is a safe choice if you want to watch the logs for false positives before you start blocking traffic.

sudo systemctl restart apache2

Add OWASP ModSecurity rules

The engine is on, but with no rules loaded it has little to act on. Add the OWASP ModSecurity rules by cloning the latest Core Rule Set from GitHub into your system directories. The Core Rule Set (CRS) is a maintained collection of detection rules. It covers common attacks such as SQL injection and cross-site scripting, and it also catches many unauthorized access attempts. The server needs outbound internet access to reach GitHub, and git must be installed.

1. Clone the latest OWASP CRS from GitHub to the /usr/share/ directory by running the commands below. When it finishes, the rule files should be in that directory.

sudo rm -rf /usr/share/modsecurity-crs
sudo git clone https://github.com/coreruleset/coreruleset.git /usr/share/modsecurity-crs

The CRS comes with an example setup file. It will not be read until you rename it.

2. Rename the example file to crs-setup.conf, using the commands in the block below.

sudo mv /usr/share/modsecurity-crs/crs-setup.conf.example /usr/share/modsecurity-crs/crs-setup.conf

Now tell Apache to load the rules. This is done in the ModSecurity security configuration file for Apache.

3. Run the commands below to open the ModSec security configuration file.

sudo nano /etc/apache2/mods-enabled/security2.conf

4. Edit the highlighted lines so they point to the OWASP rules you downloaded above. Check the paths carefully, because a typo here can stop Apache from starting.

<IfModule security2_module>
        # Default Debian dir for modsecurity's persistent data
        SecDataDir /var/cache/modsecurity
		
        # Include all the *.conf files in /etc/modsecurity.
        # Keeping your local configuration in that directory
        # will allow for an easy upgrade of THIS file and
        # make your life easier
        IncludeOptional /etc/modsecurity/*.conf
		
        # Include OWASP ModSecurity CRS rules if installed

        IncludeOptional /usr/share/modsecurity-crs/*.conf
        IncludeOptional /usr/share/modsecurity-crs/rules/*.conf
</IfModule>

5. Save the file and exit the editor.
6. Restart Apache to finish the process, using the command in the block below.

If Apache fails to restart, the most likely cause is a wrong path in the file you just edited. Reopen it, fix the line and try again. Reverting your edits to that file also returns you to the working setup from before this section.

sudo systemctl restart apache2

Now check that ModSec runs correctly. Run the commands below.

curl 'http://127.0.0.1/test.html?a=<script>alert(1);</script>'

An output message similar to the one below should appear. If it does not, check the Apache error log for messages about ModSecurity or the rule files.

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
<hr>
<address>Apache/2.4.52 (Ubuntu) Server at 127.0.0.1 Port 80</address>
</body></html>

That completes the setup.

Conclusion:

• ModSecurity is a powerful open-source web application firewall (WAF) that offers an extra layer of security to detect and prevent attacks before they reach the web application.
• Following the installation steps outlined above, you can successfully set up ModSecurity with Apache on Ubuntu Linux.
• OWASP ModSecurity rules, when applied, provide recommended security settings to protect your applications further.
• After completing the installation and configuration, you can verify the functionality of ModSecurity by testing it with a sample HTTP request.
• Your feedback is welcomed, and please feel free to use the comment form below to report any errors or add additional insights.